Three Azure virtual machines in different resource groups must all use the same Azure identity to access a storage account. The identity should keep working even if one VM is rebuilt. What should you use?

A system-assigned managed identity on each VM

A system-assigned identity is tied to one VM, so each VM would have a different identity and lifecycle.

A shared VM administrator password

An administrator password is for sign-in to the VM, not for secure shared access to Azure resources.

A storage account SAS token

A SAS token grants limited storage access, but it is a token, not a reusable identity for multiple VMs.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: A user-assigned managed identity — A user-assigned managed identity is designed for reuse across multiple Azure resources. You can attach the same identity to each VM and grant it the storage permissions once, which is simpler than managing separate identities for each machine. Because the identity exists independently of any single VM, it remains available if one VM is rebuilt or replaced. That makes it the best answer for shared, durable identity-based access. Why others are wrong: A system-assigned managed identity is unique to each VM, so it does not satisfy the shared-identity requirement. A shared administrator password is unrelated to Azure authorization and is a poor security practice. A SAS token can work for storage access, but it is not a persistent identity that can be attached to multiple VMs and managed centrally.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.